[Starlingx-discuss] [containers] How can I do a pull of Docker images with keystone

[Perez Carranza, Jose]

Hi Erich

I already received the info from Jerry, seems like we missed to continue the conversation on this tread. Below you can find the answer:

===========
Hi José,

In order to pull Docker image with keystone authentication, please first run docker login:
sudo docker login registry.local:9001
It will ask for your credentials at this point. Use your keystone credentials. After that, you can just use docker pull.

We currently allow the "admin" user to interact with all repos while regular users can only interact with their own.
In your example, only "admin" and " docker.io " users can pull registry.local:9001/docker.io/kolla/ubuntu-source-nova-novncproxy

Thanks,
Jerry

============

Regards,
José


> -----Original Message-----
> From: Cordoba Malibran, Erich
> Sent: Wednesday, July 10, 2019 4:37 PM
> To: Perez Carranza, Jose <jose.perez.carranza at intel.com>; starlingx-
> discuss at lists.starlingx.io; jerry.sun at windriver.com
> Subject: Re: [Starlingx-discuss] [containers] How can I do a pull of Docker
> images with keystone
> 
> I'm having the same issue trying to use the registry in controller-0.
> In a standard configuration, from a worker I run this:
> 
> $ docker pull registry.local:9001/calico/node:v3.6.2
> Error response from daemon: Get
> https://registry.local:9001/v2/calico/node/manifests/v3.6.2: unauthorized:
> authentication required
> 
> Also, using curl and specifying the certificate:
> 
> $ sudo curl --cacert /etc/docker/certs.d/registry.local:9001/registry-cert.crt -v -
> X GET https://registry.local:9001/v2/_catalog
> {"errors":[{"code":"UNAUTHORIZED","message":"authentication
> required","detail":[{"Type":"registry","Class":"","Name":"catalog","Action":"*"}]
> }]}
> 
> It seems that the authentication should be performed with the registry- token-
> server. So, it is possible to use the registry in controller-0 from command line
> or is only intended to be used by the configuration tools?
> 
> Thanks
> 
> -Erich
> 
> On Mon, 2019-07-08 at 21:20 +0000, Perez Carranza, Jose wrote:
> > Hi Jerry
> >
> > I was trying to do a pull of an image and according to this patch [1]
> > I'm required a Keystone token to get access to the registry. Are you
> > able to explain what are the steps that I need to do to pull of an
> > image on the local registry using correct keystone authentication.
> >
> > ==========
> > sudo docker -D pull registry.local:9001/docker.io/kolla/ubuntu-
> > source-nova-novncproxy
> > Using default tag: latest
> > Error response from daemon: Get https://registry.local:9001/v2/docker
> > .io/kolla/ubuntu-source-nova-novncproxy/manifests/latest:
> > unauthorized: authentication required
> > ===========
> >
> > 1. https://review.opendev.org/#/c/626355/
> >
> > Regards,
> > José
> >
> >
> > _______________________________________________
> > Starlingx-discuss mailing list
> > Starlingx-discuss at lists.starlingx.io
> > http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss